feat(cli): add device authorization login

docs/deploy/cloud.mdx

@@ -36,7 +36,15 @@ Cloud rendering needs a HeyGen credential. Sign in once — the CLI stores it in
     # ✓ Signed in as you@example.com.
     ```
 
-    For CI or headless machines, use a long-lived API key instead:
+    From an attended SSH/headless terminal, use the device flow. Open the
+    displayed URL on any browser and enter the one-time code:
+
+    ```bash
+    hyperframes auth login --device
+    ```
+
+    Device login is intentionally refused in CI and non-TTY sessions. For
+    unattended agents and CI, use a long-lived API key instead:
 
     ```bash
     # Interactive hidden-input prompt

packages/cli/src/auth/errors.ts

@@ -9,6 +9,7 @@ export type AuthErrorCode =
   | "API_ERROR"
   | "UNAUTHENTICATED"
   | "OAUTH_NOT_CONFIGURED"
+  | "DEVICE_AUTH_FAILED"
   | "REFRESH_FAILED";
 
 export class AuthError extends Error {
@@ -61,6 +62,13 @@ export const ErrRefreshFailed = (detail?: string) =>
     "Run `hyperframes auth login` to re-authenticate.",
   );
 
+export const ErrDeviceAuthFailed = (detail: string) =>
+  new AuthError(
+    "DEVICE_AUTH_FAILED",
+    `Device authorization failed: ${detail}`,
+    "Run `hyperframes auth login --device` to start a new code.",
+  );
+
 export function isAuthError(err: unknown): err is AuthError {
   return err instanceof AuthError;
 }

packages/cli/src/auth/index.ts

@@ -33,7 +33,9 @@ export type { UserInfo } from "./client.js";
 
 export {
   assertOAuthConfiguredOrExit,
+  persistVerifiedOAuthSession,
   refreshTokens,
   revokeTokens,
   startAuthorizationCodeFlow,
+  startDeviceAuthorizationFlow,
 } from "./oauth.js";